commit dd5a4f0ef32dbb30575a68b6869a68fc30c57dc4
author Bernie Innocenti <codewiz@google.com> Thu Jul 19 18:06:52 2018 +0900
committer Bernie Innocenti <codewiz@google.com> Fri Jul 20 00:13:48 2018 +0900
tree cf1092abea692c1089fdb3eb88a970664fbf3a96
parent 286d426d5459428b9db616c734b47813181c8c50

Fix use-after-free in NetworkController::removeInterfaceAddress()

Test: system/netd/tests/runtests.sh
Bug: 111381576
Change-Id: I0ebb9ac758b55f10536fef75f0eb7b69e2feccbc

server/NetworkController.cpp

diff --git a/server/NetworkController.cpp b/server/NetworkController.cpp
index ed5156f..2242d42 100644
--- a/server/NetworkController.cpp
+++ b/server/NetworkController.cpp
@@ -629,7 +629,9 @@
     std::unordered_set<unsigned>& ifindices = ifindicesIter->second;
     if (ifindices.erase(ifindex) > 0) {
         if (ifindices.size() == 0) {
-            mAddressToIfindices.erase(ifindicesIter);
+            mAddressToIfindices.erase(ifindicesIter);  // Invalidates ifindices
+            // The address is no longer configured on any interface.
+            return true;
         }
     } else {
         ALOGE("No record of address %s on interface %u", address, ifindex);